1. Canada Anti-Spam Legislation (CASL) Cloudy with a Chance of Spam
June 18, 2014
St. John’s Institute, Edmonton, AB
Presented by Joan Braun, L.L.B., M.S.W.
Teresa Mitchell, L.L.B.
Lesley Conley, Program Coordinator
Centre for Public Legal Education Alberta

2. Centre for Public Legal Education Alberta (CPLEA)
Introductions
Who Are We?
What Do We Do?
CPLEA uses a collaborative approach to develop materials and strategies for teaching people about the law.

3. Goals for Today 1. To Gain a Basic Understanding of CASL
2. Learn about Tips and Tools to Prepare

4. Outline Overview of CASL
Website and Resources
What’s next

5. What is CASL? Overview General intent of the legislation
Wide-ranging coverage
Nickname: stands for Canada’s Anti-Spam Legislation
Federal Law – applies across Canada
Date in Force: July 1, 2014
General Intent – Industry Canada – The general purpose of CASL is to encourage the growth of electronic commerce by ensuring confidence and trust in the online marketplace.
Wide-ranging – covers – unsolicited CEMS, hacking, malware, spyware, “phishing”, invasion of privacy

6. Commercial Electronic Messages
What is a CEM?
Transaction or act of a commercial character
A Commercial Electronic Message or CEM is an electronic message that has as its purpose encouraging participation in a commercial activity and that is sent from or received by a computer in Canada.
A “commercial activity” means a transaction or act that is of a commercial character, whether or not it is done with an expectation of profit. This means that many of the s, electronic newsletters and other means that registered charities and not-for-profits use to communicate with volunteers, donors, members and members of the public may now be regarded as CEMs and fall under the provisions of CASL.

7. Key Provisions Exceptions for Registered Charities
Consent – Express & Implied
Existing Business & Non-Business Relationships
Dealing with Third Parties
Subscribe & Unsubscribe Mechanisms
Tracking (options)
Automated Message Systems

8. Exception for Registered Charities
What do the regulations say…..
Raising funds vs. Fundraising
Regulations to CASL state that anti-spam provisions do not apply to a CEM that is sent by or on behalf of a registered charity as defined of the Income Tax Act and the message has as its primary objective raising funds for the charity.
Raising Fund / Fundraising
Clarification by Industry Canada
- all CEMs by registered charities – fundraising will fall under CRA guidelines
Examples – see next Slide
IMPORTANT: This exception does not apply to Not-for-Profits or Registered Amateur Athletic Associations.

9. What is permissible.... Soliciting donations
Tickets to dinners / golf tournaments & other fundraising events
Lotteries
Fun runs, etc.
Promoting events by arts & culture groups through ticket sales
Promoting charitable events even if on a cost-recovery basis
Newsletters that promote fundraising events, even if they list corporate sponsors

10. Consent Express Consent Implied Consent What’s excluded …..
Consent is the key concept to be aware of in CASL
Express Consent
Implied Consent
What’s excluded …..

11. Express consent (Gold Standard)
Recipient must voluntarily agree to receive CEM
Consent can be verbal or written
Must be documented

12. Implied Consent Can be implied in three situations:
where there is an existing business relationship, or an existing non-business relationship
where the recipient has “conspicuously published” their electronic address
where the recipient has disclosed their electronic address to the person who is sending the message;
Under CASL, consent can be implied in three situations:
Generally speaking, implied consent lasts for two years, providing an opportunity for organizations to change an implied consent to an express consent. CASL includes a transition period that allows for implied consents to remain active until July 1, In addition, where there is an existing business relationship, each transaction renews the implied consent, so that the two-year existing business relationship starts over.
It is important to note that after July 1, 2014 CEMs may only be sent with the explicit or implied consent of the recipient. Because a message seeking explicit consent is, in itself, a CEM, after July 1, 2014 these can only be sent to people or organizations with which you have an implied consent relationship.

13. Prescribed Information
SENDER of a CEM must:
Clearly indentify self
Clearly state the purpose of the CEM
Give contact information
State that consent can be withdrawn at any time

14. Existing Non-Business Relationships Registered Charities & NFPs
An organization has an existing non-business relationship with a recipient if the recipient has, within the previous two years:
In the case of a registered charity – made a donation or gift, or has performed volunteer work for the charity
In the case of a not-for-profit - has been a member of the organization, such as a club or association.
Each time that a recipient makes a donation or gift, or volunteers, the two-year implied consent period begins again. It is the same case for not-for-profits. Each time a member renews, the two-year implied consent period begins again.
Existing Non-Business Relationships are of particular importance to registered charities and not-for-profits.

15. Existing Business Relationship
An existing business relationship between the sender of the CEM and the recipient will be found if, within the previous two years the recipient has:
purchased, leased or bartered a produce, goods, services, land or an interest in land from the sender;
accepted a business, investment or gaming opportunity offered by the sender;
entered into a written contract or made inquiries about other matters with the sender for another matter not listed above;
within the previous six months, made an inquiry or an application about any of the matters listed above.
……… more

16. Existing Business Relationship
Rolling time frame….
The existing business relationship is renewed with each transaction, in that the two-year existing business relationship starts over.

17. Existing Non-Business Relationship Excluded CEMs (Part 1)
There are a number of CEMs to which CASL does not apply.
These include messages sent:
to someone with whom the sender has a personal or family relationship;
to someone in a commercial activity making an inquiry or application about the activity, such as quotes or estimates;
to another employee, representative, consultant or franchisee of an organization about the activities of the organization;

18. Existing Non-Business (excluded CEMs cont’d)
to an employee, representative, consultant or franchisee of another organization, if the organizations have a relationship and the message is about the activities of the receiving organization;
in response to a request, question or complaint, or is otherwise initiated by the recipient;
by or on behalf of a registered charity and the message has as its primary objective raising funds for the charity;
by or on behalf of a political party or a political candidate for publicly elected office, for the primary purpose of obtaining a donation or contribution.

19. Excluded CEMs (Part 2)
There is another type of CEM which is excluded from the provisions of CASL. There are two requirements for CEMs that fall under this exception:
They must conform to the rules about providing sender identity information and …
They must have an unsubscribe mechanism so that the recipient can opt not to receive future CEMs

20. Excluded CEMs (Part 2)(cont’d)
These messages must solely:
facilitate, complete or confirm a commercial transaction that the recipient previously agreed to enter into with the sender;
provide warranty, product recall or safety and security information about a product or service that the recipient has used or purchased;
provide product, goods or services updates or upgrades that the recipient is entitled to receive;
provide ongoing information about a subscription, loan, membership or account that the recipient is currently participating or enrolled in;
provide information directly related to an employment relationship or benefit plan in which the recipient is involved or enrolled.
There is some uncertainty at the moment about the meaning of “solely” at this time. Further clarification is expected from the CRTC.

21. Third Parties Referrals
Limited exemption for 3rd party referrals following a referral by someone who has:
an existing business relationship;
an existing non-business relationship;
a personal relationship; or
family relationship with the individual who sends the message as well as these relationships with the individual to whom the message is sent.
There is another limited exemption to the consent provisions of CASL for third party referrals. The CRTC states that the consent provisions do not apply to the first commercial electronic message that is sent by an individual for the purpose of contacting a recipient following a referral by someone who has:

22. Third Party Referral Messages
CEM Requirements
must disclose the full name of the individual or individuals who made the referral and state that the message is sent as a result of the referral
must also comply with the sender identity information and unsubscribe mechanism requirements.
Only one 3rd party referral message may be sent under these terms, so it should contain a request for future consent.

23. Relationships with 3rd Parties
Be aware of what contracts are in place in which the 3rd party may be sending CEMs on your organizations behalf
Examples:
Advertising agencies
Social media management
Sales or distribution agents
Lobbyists, public relations or media advisors
Professional fundraising companies
Suppliers of referral / contact lists
Relationships with Third Parties
Under CASL organizations must also be aware of what contracts they have entered into that may involve a third party sending CEMs on their behalf.

24. 3rd Party Relationships –Key Issues
Review all contracts:
Make sure that any CEMs sent on your organization’s behalf are CASL compliant
Contracts should contain clauses that ensure that the service provider will meet all applicable CASL requirements, and will notify you if it is cited by CRTC for a violation
Ensure service provider will keep your organization indemnified for any costs or damages arising out of a breach.
You should also ask your service provider to inform your organization of all unsubscribe requests and to keep records of CASL compliance.

25. Acceptable Subscribe Mechanisms
Checking a box to indicate consent
Typing an address into a field to indicate consent

26. Not Acceptable
An example of toggling that assumes consent

27. Acceptable wording for Unsubscribe Request

28. Unsubscribe Mechanism
One of the most important components of the CASL scheme.
Every CEM must provide a way for recipients to unsubscribe
Simple, easy & quick
Free
Means to contact the sender must be operational for at least 60 days
Cannot use a “pre-checked” box (toggle box)
An unsubscribe request must be acted on within 10 business days.
Examples ….

29. Tracking Tracking should cover: express consents; implied consents;
conversion of implied consents to express consents; and
implementation of unsubscribe requests and the date it was done.
For an example of a simple spreadsheet to track CEMs, see the Sample Tracking Spreadsheet under Tips and Tools.
It is very important that registered charities and not-for-profits begin to track recipient consents.
Depending on the size of the organization, this could be as simple as an Excel spreadsheet for a small charity or fully integrated databases for a larger entity.

30. Automated Message Systems
High Tech / Low Tech
Benefits / Advantages
Cost - variety of factors come into play
Staff time vs subscription costs

31. The Regulators CRTC Competition Bureau Privacy Commission
CRTC – main regulator, investigative posers: assess the AMPs
Competition Bureau – monitor false/misleading online representations, advertising and marketing
Privacy Commission – collecting information on Canadians and address harvesting

32. Penalties Administrative Monetary Penalties ( AMPs)
Vicarious Liability
Private right of action – After July 1, 2017
Administrative Penalties
Up to $1 million for individual
-Up to 10 million for corporations
This is per violation
Vicarious Liability – (Due Diligence)
Directors & officers – act of corporation
- Corporation (organization) for acts of employees
Private right of Action – Law Suit – After July 1, 2017

33. Timelines July 1, 2014 – CASL in effect (for the most part)
If you had an existing business relationship or non existing non-business relationship before CASL came into effect your organization can rely on implied consent for the 3 year transition period…

34. Timelines (cont’d) Between July 1, 2014 and July 1, 2016 July 1, 2017
If transaction, volunteering, or donation takes place this restarts the 2 year window for implied consent
July 1, 2017
Private rights of action
3-year transition period for changing over - consents ends

35. Definitions CPLEA - CASL website Legislation Industry Canada
Imagine Canada – listed under additional resources

36. FAQs

37. Tips and Tools to help… Top Ten Tips
CASL Initial Compliance Questionnaire
Registered Charity Decision Tree
Not-for-Profit Decision Tree
Sample Tracking Spreadsheet
Timelines Checklist
Information and Resources for Not-for-Profits and Registered Charities (Booklet, PDF 30 p.)

38. Additional Resources
Government of Canada Updates:
Non-Profit Sector
Law Firms

39. For further information or training, contact us at:
Thank you!
For further information or training, contact us at:
CASL for Charities and NFPs